Extract data from incident reports
Unstract reads workplace, security and cyber incident reports, typed, scanned or finished by hand, and turns what happened, who was involved and who saw it into checked data in your claims or risk management system.
OSHA 300 log entry made, rack inspected 10/28 — R.O.
NPL-SAF-02 INCIDENT REPORT (REV 03/2025)
{ "report_number": "IR-2026-0317", "incident_date": "10/27/2026", "location": "Warehouse 3, Dock 7", "incident_type": "injury", "injured_person": "Duarte, Marisol", "injury": "Fracture, left wrist", "witnesses": 2, "damage_estimate": 6200, "policy_number": "SWM-WC-6630192", "confidence": 0.93}
Trusted by insurance teams around the globe
Every employer writes up an incident its own way
A typed report on a broker's template is rare. Most incidents reach the claims desk on the employer's own form, the security team's write-up or a page someone filled in on the shop floor.
Scanned on the warehouse copier, then faxed to the broker
One incident, on the employer's form, the OSHA 301 and a security log
Written up at the end of a shift, the time struck out and corrected
Report, witness statements, photos and a clinic note in one email
Monthly incident logs and cyber timelines in no fixed layout
Someone reads each report to work out whether it is a claim, a notice to the carrier or a near miss to log, and late notice costs coverage while it sits.
Unstract reads every incident report, extracts the incident details you name, checks them against the policy and sends each one to the right place in your claims or risk management system.
From an incident write-up to a claim or a logged near miss
Three products, each useful alone: one reads the report, one turns it into fields, one runs everything after. Use the one your team needs first and add the others later.
Read every incident report, tick boxes and handwritten notes included
Capture the text of an employer's incident report, an OSHA 301, a security officer's report or a cyber incident write-up with each answer still beside its question. The incident-type boxes keep their ticks, each witness stays in the witness block, and a supervisor's line added in pen under the typed description comes out as text.
Send the text to your own LLM, or make reading the report the first step of claim intake.
Learn more about LLMWhispererTurn incident reports into one record per incident
Name the incident details you want and every report returns the same JSON record, whether an employer, a security contractor or an IT team wrote it. Injured people, witnesses, damaged property and the actions taken each get their own fields. An incident date outside the policy period, or a report sent to the broker weeks after the event, comes back flagged with the reason.
Brokers can post reports to it as an API from a client portal, carriers can run it as an ETL pipeline over the shared incident mailbox, and either can make it the reading step of a larger claims workflow.
Learn more about Document StudioSend each incident where it belongs, without reading it twice
Describe your incident report intake in plain English and Flow's agents build the workflow. Reports arrive from email, web forms and broker uploads, the attachments are sorted, and the people, damage and actions are read. The policy is checked as in force on the incident date with the loss type covered, injury incidents go to an adjuster, near misses go to the risk log, and the claim opens in your claims or risk management system, such as Guidewire ClaimCenter or Duck Creek Claims. You approve the workflow once and every report then runs through it the same way.
Choose in advance when a person takes over: coverage in doubt, a fraud flag, an amount above an adjuster's authority, a line the reader isn't sure of. Only those reports wait, handed to an adjuster or the special investigations unit with the reason shown.
Learn more about FlowExtract from incident reports today. Automate claim intake when you're ready.
Start for free to parse and extract your own incident reports now. Automating the intake around them begins with a consultation.
Incident reports of every kind, from the warehouse to the network
Documents
- Claim incident reports
- Contractor significant incident reports
- Cyber-security incident reports
- Environmental incident reports
- Medicaid critical incident reports
- Medication incident or error reports
- Network incident reports
- Non-injury and near-miss incident reports
- Offense or incident reports
- Security incident reports
- Workplace violence incident reports
- OSHA 301 injury and illness incident reports
- Witness statements
- Incident photos and clinic notes
Fields captured
For the teams that act on an incident after it is written up
The injured person, the witnesses and the damage estimate already on the claim, with the policy checked for the incident date before the adjuster calls anyone.
Incident reports from every client read the same way, so a notice goes to the right carrier on the day it arrives and nothing is reported late.
Every incident across sites and subsidiaries in one dataset, ready for loss trending, renewal submissions and the next conversation with the carrier.
Near misses and recordable injuries logged from the forms supervisors already fill in, so repeat hazards show up before they cause a claim.
Incidents reported on time, claims opened with the facts in
Protected for injury details, witness names and breach reports
An incident report records an employee's injury and treatment, the names of the coworkers who saw it, and sometimes a patient's medication error. A cyber incident report goes further and describes the weakness an attacker used and which systems are still exposed. In the wrong hands that is a privacy breach for the people named and a map for the next attack.
- Encrypted in transit and at rest.
- Incident reports are never used to train any model.
- Role-based access, so injury and health details reach only the adjusters and safety leads who need them, and every correction is logged against the report.
- Retention on your terms: incident reports and the fields read from them are deleted on the schedule you set.
- Self-hosted deployment for carriers and employers that keep cyber and injury records inside their own network.
What brokers, carriers and risk teams ask about incident reports
Look for software that reads the report as written, without a template per client. Unstract does it in three layers: LLMWhisperer reads the page with its boxes, ticks and handwriting in place, Document Studio uses LLMs to pull out the incident, the people and the damage as named fields, and Flow sends the result to the carrier or the claim file. A client's own form and an OSHA 301 come back in the same record.
One that removes the reading, not just the typing. With Unstract, incident report processing starts when the report lands in the inbox: the details are extracted, the policy is checked for the incident date, and the notice reaches the claim file with nothing to key. An MGA handling several carriers' programs gets one record shape for all of them.
Yes. Security incident report data extraction covers the timeline from detection to containment, the systems and records affected, the attack type and whether a regulator or law enforcement was told. Those fields are what a cyber carrier needs before it appoints breach counsel or a forensics firm.
Employers' own incident forms, OSHA 301 reports, near-miss and non-injury reports, security and offense reports, environmental release reports, workplace violence reports and medication error reports. Fields are read by what they mean, so a form it has never seen still returns your schema.
Yes. A line written in pen under the typed description is read as text and kept apart from the original account, so you can see what was added later. It often holds the detail that matters most to a claim, such as a known fault with the equipment.
Each box is read as ticked or blank, with its label beside it. A report with both injury and property damage ticked returns both, so one incident can open a workers' compensation claim and a property claim together.
Yes. The incident type, the injury and treatment fields and any damage estimate decide the route you set: injuries and damage open a claim, near misses go to your risk log, and anything unclear waits for a person.
Yes. The policy is checked as in force on the incident date and the loss type against what it covers. A report that reached the broker long after the incident is flagged for late notice, and repeat incidents at the same site or with the same equipment are compared.
That field goes to a reviewer with the page image and the spot it came from highlighted. The reviewer confirms or corrects it, the decision is logged against the report, and the rest of the queue keeps moving.
Yes. Health and care providers file these for their liability carriers and state programs. The patient or member, the drug and dose involved, the harm reached and the follow-up taken are each read into their own fields, under the same access controls as any health record.
Unstract is SOC 2, ISO 27001, GDPR and HIPAA compliant. Incident reports are encrypted in transit and at rest, never used to train models, and kept only for as long as you choose. A self-hosted option is available, and the Trust Center lists every control.
Start for free and upload a few reports to see the fields come back. To automate the intake, a consultation maps it to your report types, coverage checks and claims or risk management system, and most teams process their first live incidents within days.
Bring a month of incident reports to the consultation
The employer forms, the security write-ups, the cyber timelines and the pages finished in pen. We run them live and show each incident detail, the policy check and why any report stopped for a person.